CVE-2026-80194: Kimai before 2.64.0 Missing Authorization via ProjectViewController export

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-08-31
Weakness: CWE-200

Description

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are attached to the sibling __invoke method rather than at the class level, so the export route inherits no authorization checks. Any authenticated user, including a plain ROLE_USER without the project_reporting permission, can download the project overview export - which returns the same dataset as the protected report - disclosing customer names, project names, currency, budget type, and aggregate totals across all customers. Actual financial figures remain protected in the export template.

Affected products

kimai: before 2.64.0 — fixed in 2.64.0

How to fix

Upgrade to a fixed version: kimai 2.64.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-80194 or the next vulnerability affects your stack